Examkin

Question

Difficulty: EasyAWS CodeBuild

A developer is setting up a build process in AWS CodeBuild that requires a database password and a software license key. The database password must be rotated automatically on a regular schedule, whereas the license key is a static configuration parameter that does not require rotation. The developer wants to retrieve these values securely during the build phase.

Which combination of steps will meet these requirements in the most secure and cost-effective manner? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file.Answer
  2. Store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.Answer
  3. C
    Store the database password in AWS Systems Manager Parameter Store and configure rotation using a custom Amazon EventBridge rule.
  4. D
    Store the database password as a plaintext environment variable in the env/variables section of the buildspec file.
  5. E
    Define the database password and license key in the trust policy of the AWS CodeBuild service IAM role.

Answer

Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file, and store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.
Storing the database password in AWS Secrets Manager enables native, automatic rotation of the credential, which can be securely fetched at build time by referencing it in the env/secrets-manager section of the buildspec file. For the static license key, AWS Systems Manager Parameter Store is a cost-effective and secure solution that does not require rotation, and can be retrieved using the env/parameter-store section of the buildspec file.

Step-by-Step Solution

1
Analyze rotation requirements for the sensitive data.
The database password requires automatic rotation, making AWS Secrets Manager the ideal service. The software license key is static and does not require rotation, making AWS Systems Manager Parameter Store a more cost-effective option.
Choosing the correct storage service based on rotation needs optimizes security and cost.
2
Identify how AWS CodeBuild references these external configurations in the buildspec file.
Secrets Manager secrets are referenced in the env/secrets-manager section, and Parameter Store parameters are referenced in the env/parameter-store section.
Using the native CodeBuild buildspec environment syntax ensures the secrets are fetched securely at runtime during the build.

Key Concept

AWS CodeBuild environment variable retrieval from Secrets Manager and Systems Manager Parameter Store
Estimated Time:50s
Rate this question

Topics

AWS CodeBuild

More questions from this topic